hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-05-14 19:29:28 +02:00
Code Issues Packages Projects Releases Wiki Activity

Java: move File inspection methods to path-injection[read]

Browse Source 
Per review feedback on #21741: File.canRead/canWrite/canExecute,
exists/isDirectory/isFile/isHidden only inspect a path, so move them
under the path-injection[read] sub-kind. Update TaintedPath.expected
and the experimental CWE-073 expected to match.
This commit is contained in:
MarkLee131
2026-05-01 16:04:29 +08:00
parent 936f0c650c
commit 119994b59f
3 changed files with 15 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
java/ql/lib/ext/java.io.model.yml
View File

@@ -3,17 +3,17 @@ extensions:
pack: codeql/java-all
extensible: sinkModel
data:
- ["java.io", "File", True, "canExecute", "()", "", "Argument[this]", "path-injection", "manual"]
- ["java.io", "File", True, "canRead", "()", "", "Argument[this]", "path-injection", "manual"]
- ["java.io", "File", True, "canWrite", "()", "", "Argument[this]", "path-injection", "manual"]
- ["java.io", "File", True, "canExecute", "()", "", "Argument[this]", "path-injection[read]", "manual"]
- ["java.io", "File", True, "canRead", "()", "", "Argument[this]", "path-injection[read]", "manual"]
- ["java.io", "File", True, "canWrite", "()", "", "Argument[this]", "path-injection[read]", "manual"]
- ["java.io", "File", True, "createNewFile", "()", "", "Argument[this]", "path-injection", "ai-manual"]
- ["java.io", "File", True, "createTempFile", "(String,String,File)", "", "Argument[2]", "path-injection", "ai-manual"]
- ["java.io", "File", True, "delete", "()", "", "Argument[this]", "path-injection", "manual"]
- ["java.io", "File", True, "deleteOnExit", "()", "", "Argument[this]", "path-injection", "manual"]
- ["java.io", "File", True, "exists", "()", "", "Argument[this]", "path-injection", "manual"]
- ["java.io", "File", True, "isDirectory", "()", "", "Argument[this]", "path-injection", "manual"]
- ["java.io", "File", True, "isFile", "()", "", "Argument[this]", "path-injection", "manual"]
- ["java.io", "File", True, "isHidden", "()", "", "Argument[this]", "path-injection", "manual"]
- ["java.io", "File", True, "exists", "()", "", "Argument[this]", "path-injection[read]", "manual"]
- ["java.io", "File", True, "isDirectory", "()", "", "Argument[this]", "path-injection[read]", "manual"]
- ["java.io", "File", True, "isFile", "()", "", "Argument[this]", "path-injection[read]", "manual"]
- ["java.io", "File", True, "isHidden", "()", "", "Argument[this]", "path-injection[read]", "manual"]
- ["java.io", "File", True, "mkdir", "()", "", "Argument[this]", "path-injection", "manual"]
- ["java.io", "File", True, "mkdirs", "()", "", "Argument[this]", "path-injection", "manual"]
- ["java.io", "File", True, "renameTo", "(File)", "", "Argument[0]", "path-injection", "ai-manual"]

2
java/ql/test/experimental/query-tests/security/CWE-073/FilePathInjection.expected
View File

@@ -9,7 +9,7 @@ edges
| FilePathInjection.java:209:24:209:31 | filePath : String | FilePathInjection.java:209:15:209:32 | new File(...) : File | provenance | MaD:6 |
| FilePathInjection.java:217:19:217:22 | file : File | FilePathInjection.java:177:50:177:58 | file : File | provenance | |
models
| 1 | Sink: java.io; File; true; exists; (); ; Argument[this]; path-injection; manual |
| 1 | Sink: java.io; File; true; exists; (); ; Argument[this]; path-injection[read]; manual |
| 2 | Sink: java.io; FileInputStream; true; FileInputStream; (File); ; Argument[0]; path-injection[read]; ai-manual |
| 3 | Sink: java.io; FileOutputStream; false; FileOutputStream; ; ; Argument[0]; path-injection; manual |
| 4 | Source: com.jfinal.core; Controller; true; getPara; ; ; ReturnValue; remote; manual |

14
java/ql/test/query-tests/security/CWE-022/semmle/tests/TaintedPath.expected
View File

@@ -235,17 +235,17 @@ edges
| Test.java:199:26:199:33 | source(...) : String | Test.java:199:19:199:33 | (...)... | provenance | Sink:MaD:59 |
| Test.java:204:29:204:36 | source(...) : String | Test.java:204:20:204:36 | (...)... | provenance | Sink:MaD:68 |
models
| 1 | Sink: java.io; File; true; canExecute; (); ; Argument[this]; path-injection; manual |
| 2 | Sink: java.io; File; true; canRead; (); ; Argument[this]; path-injection; manual |
| 3 | Sink: java.io; File; true; canWrite; (); ; Argument[this]; path-injection; manual |
| 1 | Sink: java.io; File; true; canExecute; (); ; Argument[this]; path-injection[read]; manual |
| 2 | Sink: java.io; File; true; canRead; (); ; Argument[this]; path-injection[read]; manual |
| 3 | Sink: java.io; File; true; canWrite; (); ; Argument[this]; path-injection[read]; manual |
| 4 | Sink: java.io; File; true; createNewFile; (); ; Argument[this]; path-injection; ai-manual |
| 5 | Sink: java.io; File; true; createTempFile; (String,String,File); ; Argument[2]; path-injection; ai-manual |
| 6 | Sink: java.io; File; true; delete; (); ; Argument[this]; path-injection; manual |
| 7 | Sink: java.io; File; true; deleteOnExit; (); ; Argument[this]; path-injection; manual |
| 8 | Sink: java.io; File; true; exists; (); ; Argument[this]; path-injection; manual |
| 9 | Sink: java.io; File; true; isDirectory; (); ; Argument[this]; path-injection; manual |
| 10 | Sink: java.io; File; true; isFile; (); ; Argument[this]; path-injection; manual |
| 11 | Sink: java.io; File; true; isHidden; (); ; Argument[this]; path-injection; manual |
| 8 | Sink: java.io; File; true; exists; (); ; Argument[this]; path-injection[read]; manual |
| 9 | Sink: java.io; File; true; isDirectory; (); ; Argument[this]; path-injection[read]; manual |
| 10 | Sink: java.io; File; true; isFile; (); ; Argument[this]; path-injection[read]; manual |
| 11 | Sink: java.io; File; true; isHidden; (); ; Argument[this]; path-injection[read]; manual |
| 12 | Sink: java.io; File; true; mkdir; (); ; Argument[this]; path-injection; manual |
| 13 | Sink: java.io; File; true; mkdirs; (); ; Argument[this]; path-injection; manual |
| 14 | Sink: java.io; File; true; renameTo; (File); ; Argument[0]; path-injection; ai-manual |